CVE-2025-6188: On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do n

Published Aug 25, 2025

Updated

On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication.

Affected Software

1 affected component

Arista EOS

Remediation

Information

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades https://www.arista.com/en/um-eos/eos-upgrades-and-downgrades CVE-2025-6188 has been fixed in the following releases: * 4.34.0 and later releases in the 4.34.x train * 4.33.2 and later releases in the 4.33.x train * 4.32.5 and later releases in the 4.32.x train * 4.31.7 and later releases in the 4.31.x train * 4.30.10 and later releases in the 4.30.x train

Event History

Aug 25, 2025

CVE Published

via MITRE·08:14 PM

Data Sourced

via MITRE·08:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-6188?

CVE-2025-6188 is classified as a moderate-severity vulnerability due to its potential impact on UDP-based services.

How do I fix CVE-2025-6188?

To mitigate CVE-2025-6188, users should update their Arista EOS to the latest version that addresses this vulnerability.

What platforms are affected by CVE-2025-6188?

CVE-2025-6188 affects platforms running Arista EOS software.

What types of attacks can be conducted using CVE-2025-6188?

CVE-2025-6188 can allow attackers to send maliciously formed UDP packets, potentially causing unexpected behaviors in vulnerable services.

Is authentication required to exploit CVE-2025-6188?

No, CVE-2025-6188 can be exploited by using unauthorized UDP packets which do not require authentication.